Trinidad and Tobago Data Protection Act 2011 s38: ss.38 to 41, 42(c) to (l), 43 to 45 Public bodies: use and disclose personal information only for the purpose, a consistent use, or a listed ground; restrict sensitive and medical data (not yet proclaimed)

What does s38 require?

Without consent, a public body may use personal information only for its purpose or a consistent use, and disclose it only on the grounds listed (court process, the Attorney General in State proceedings with notice, designated investigative bodies on written request, law enforcement agencies, foreign law enforcement under agreement, compelling health or safety circumstances with notice, contacting next of kin, collecting debts, research under conditions and signed agreements, archives). Sensitive personal information needs consent unless for health care, made public, research, law enforcement and national security, social services or written law (an offence otherwise), and medical information may be disclosed only with consent or a court order.